What is the recent activity page?

The recent activity page shows info about when and where you've used your Microsoft account within the last 30 days. This includes any time that you signed in to your account, whether you used a web browser, your phone, an email app, a third-party app, or another method. See your r﻿ecent activity.

What info is available?

For each activity, the recent activity﻿ page lists the date and time, location, and type of activity. Keep in mind that if you use a mobile device, your location may not be reliable. This is because mobile phone services route your activity through different locations. This can make it look like you signed in from somewhere you're not.

You can click any activity to expand it and see additional details, including:

The IP address of the device on which the activity occurred

What type of device or operating system was used

What internet browser or type of app, if any, was used

How do I use this page?

We pay attention to how you tend to use your account, and will let you know right away if we think something is unusual. On the recent activity page, we divide your activity into two groups: Unusual activity and Recent activity.

Manage your unusual activity

If there is unusual activity on your account, we should already have notified you through email. Review the session and decide This was me or This wasn't me.

When you tell us that you don't recognize an activity, it's possible that a hacker or malicious user has gotten access to your account. Once you select This wasn't me, we'll walk you through several steps to help protect your account. This includes changing your password and updating your security info.

If we accidentally flag your activity as unusual, make sure you let us know that it was you. For example, this might happen if you use your account on vacation, get a new device, or allow an app to sign in as you.

Manage your recent activity

You should recognize most of the account activity in this section. If you know that you didn't initiate one of them, or if you see a suspicious pattern (like multiple sign-in attempts or profile changes to you didn't make) you can always let us know by selecting Secure your account.

What if some recent activity doesn't show up?

You might notice that not everything you do with your account is tracked on this page. We try to focus on the most significant events to help you keep an eye on your account security. That means that if you sign in from the same device and location several times in a row, we might only track the first time. Similarly, if you check the Keep me signed in box we won't track your everyday activity until something changes.

What are the different session types?

This table explains all the activities that are tracked in the recent activity page.

Session type

What it means

Account created

A Microsoft account was created.

Account name changed

The name that identifies you in the Microsoft products and services you use has changed.

Additional verification requested

As an extra authentication step, you received a security code by text, email, or authenticator app.

Alias added;

Alias deleted;

Primary alias changed

An alias is an additional email address that uses the same inbox, contact list, and account settings as the primary alias (email address) for your Microsoft account. Learn mor﻿e about aliases.

Someone tried to sign in to your Microsoft account with the wrong password. We didn't allow this sign-in. (This might have been you, if you forgot your password—or it might have been someone else trying to access your account.)

Password changed

Your Microsoft account password was changed. If you didn’t do this, you should reset your password.

Someone signed in to your account with the correct password, but from a location or device that we didn't recognize. We sent you a notification and required an extra security challenge. (This might have been you, but we weren't sure.)

Email protocols

Email apps and webmail services use different protocols, or communication formats, to access your account. You might see one or more of the following protocols listed in your recent activity: